Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-8017

CWE-20 — Improper Input Validation4 documents4 sources

Severity

4.1MEDIUM

EPSS

14.3%

top 5.60%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Mcafee Virusscan Enterprise Intel Virusscan Enterprise Linux (vsel)

Timeline

PublishedMar 14

Latest updateMay 17

Description

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:NExploitability: 2.3 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5intel/virusscan_enterprise_linux_(vsel)2.0.3 (and earlier)

▶NVDmcafee/virusscan_enterprise2.0.3

🔴Vulnerability Details

GHSA

GHSA-9g8x-w8q9-8hx8: Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2↗2022-05-17

▶

CVEList

CVE-2016-8017: Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2↗2017-03-14

▶

💥Exploits & PoCs

Exploit-DB

McAfee Virus Scan Enterprise for Linux 1.9.2 < 2.0.2 - Remote Code Execution↗2016-12-13

▶